Oh, the old postini service I believe is separate from Google apps. Gmail, Google Apps, and the legacy spam filtering product I believe are all separate even though they're all Google. In that case I still recommend checking for mistakes in your whitelisting rules that might be letting in a lot of spam. Moving from exchange to Office 365 is supposed to be doable too if it's easier to outsource than maintain a Microsoft Exchange server in your office.